Re: [Prelude Hybrid IDS] #145: prelude-manager trying to input text into bytea fields and failing

#145: prelude-manager trying to input text into bytea fields and failing
------------------------------------+---------------------------------------
 Reporter:  [email protected]  |        Owner:  yoann             
     Type:  defect                  |       Status:  assigned          
 Priority:  high                    |    Milestone:  LibpreludeDB 0.9.4
Component:  libpreludedb            |      Version:  0.9               
 Severity:  normal                  |   Resolution:                    
 Keywords:  bytea additional_data   |  
------------------------------------+---------------------------------------
Changes (by yoann):

  * component:  generic => libpreludedb
  * milestone:  => LibpreludeDB 0.9.4
  * status:  new => assigned

Old description:

> I found weird messages in my logs like this:
>
> prelude-manager: could not insert message into database: Query error:
> ERROR:  invalid input syntax for type bytea .
>
> I did some investigating, and these log entries are happening every time
> one of my prelude-lml entries derived from ntsyslog comes in.  Here's a
> dump from the manager's debug output:
>
>         additional_data(0):
>                 type: string (0)
>                 meaning: Log received from
>                 data: /var/log/winmessages
>         additional_data(1):
>                 type: string (0)
>                 meaning: Original Log
>                 data: Apr 17 00:26:35 123.123.123.123 security[failure]
> 681 NT AUTHORITY\SYSTEM  The logon to account: Administrator  by:
> MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  from workstation: HOST-NAME
> failed. The error code was: 3221225578
> could not insert message into database: Query error: ERROR:  invalid
> input syntax for type bytea
> .
>
> In the database, prelude_additionaldata's data field is indeed bytea! A
> cursory googling for this shows that we need to be using PQescapeBytea
> for this type of field.. Can someone fix this?

New description:

 I found weird messages in my logs like this:

 prelude-manager: could not insert message into database: Query error:
 ERROR:  invalid input syntax for type bytea .

 I did some investigating, and these log entries are happening every time
 one of my prelude-lml entries derived from ntsyslog comes in.  Here's a
 dump from the manager's debug output:

 {{{
         additional_data(0):
                 type: string (0)
                 meaning: Log received from
                 data: /var/log/winmessages
         additional_data(1):
                 type: string (0)
                 meaning: Original Log
                 data: Apr 17 00:26:35 123.123.123.123 security[failure]
 681 NT AUTHORITY\SYSTEM  The logon to account: Administrator  by:
 MICROSOFT_AUTHENTICATION_PACKAGE_V1_0  from workstation: HOST-NAME
 failed. The error code was: 3221225578
 could not insert message into database: Query error: ERROR:  invalid input
 syntax for type bytea
 .
 }}}

 In the database, prelude_additionaldata's data field is indeed bytea! A
 cursory googling for this shows that we need to be using PQescapeBytea for
 this type of field.. Can someone fix this?

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/145>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel